Hacker News Reader

what if the tea.xyz domain is deleted? or the site serving it is down? even if it's using something like AWS there is some downtime there..

That depends on what the site itself is doing. It might be easy to setup mirrors or run your own version locally. The package registry data and hosted content would be available whether the site existed or not.

Didn't see that, but...

Now if someone successfully publishes a hack that steals everyone's data and/or creates a botnet everywhere it's installed, there's no way to actually pull it down and override it.

Unless there's a centralized authority with the ability to do that, in which case it's not decentralized and we're just changing who controls it.

Right, but any existing package registry could do the same thing if they wanted to. You don't need a blockchain for this.